Docs-Sync #448: a decided roadmap question, and release-lab counts outside the guard #453

Source pull request: #448

Affected doc surfaces: docs/roadmap.md, deploy/desktop/README.md, scripts/release-lab/README.md.

The objective drift from #448 is already corrected in #452 (desktop download claims, the Quit NodePilot tray entry, the fourth release gate in CLAUDE.md, and the custom-activity globals contract). The three findings below were deliberately not applied.

• docs/roadmap.md § E — Offene Entscheidungen — the "Downloads in der Desktop-App zulassen?" row has been decided and built, and its body is now false. The row still states that hardenSession "verwirft jeden Download (will-download → preventDefault)" and that the SPA's download-based exports "bleiben in der Desktop-App wirkungslos". Fix desktop downloads and Custom Node globals, add computer-use release gate #448 replaced that with a same-origin allow plus the native Save As dialog, so workflow export and configuration backup work in the shell. The section's lead-in also says "Diese fünf Punkte können nicht gebaut werden, solange die Entscheidung aussteht" — retiring this row makes it four. Not auto-applied: docs/roadmap.md is the leading document for what gets built, and this row came from the 2026-09-05 audit as an open question for the maintainer. Whether it is struck, moved to a done/decided section, or kept with corrected wording is a human decision, and so is the fünf count that follows from it.

• deploy/desktop/README.md:298 — the known-gaps list describes the security.ts vitest coverage as "permission and download blocking". The suite now also covers the allow path (blocks downloads redirected through a foreign origin and unregistered windows), so "blocking" understates what is tested. Not auto-applied: the claim is incomplete rather than false, and this is an honest-inventory section whose wording the maintainer sets.

• scripts/release-lab/README.md:92-94 — four new count-bearing claims sit outside DocumentationCountsTests, and two use a different basis than every other doc surface. The numbers all match scripts/release-lab/computer-use/catalog.py exactly (164 cases, 33 ACTIVITIES, 22 SETTINGS, 11 THEMES), so nothing is wrong today — but nothing derives them either, which is the same gap Docs-Sync #402: two README activity-count claims sit outside DocumentationCountsTests #404 was filed for. Two of them also collide with the repo's established figures: the catalog's "33 Activity types" counts 27 activities plus the 6 trigger node types, while ActivityCatalog.cs yields 27 and that is the number guarded in README.md, content/{de,en}/concepts/workflows.md and both website dictionaries; and "11 themes" includes system, which DocumentationCountsTests explicitly excludes ("system is not a skin — it resolves to one — so the doc phrasing says 'N Skins + system'"), against a 10-entry themeStore.ts. Not auto-applied: whether to add guard rows, relabel the catalog's figures (e.g. "33 node types (27 activities + 6 triggers)"), or leave the release-lab README outside the guard is a judgement call about what the catalog is counting.

Automated docs-drift finding from the daily documentation-sync routine — needs triage.